TryHackMe! Upload Vulnerabilities - File Upload Vulnerabilities & Exploit - Complete walkthrough

In this video I will take you through a longer and more complete walkthrough of Upload Vulnerabilities & Exploit the room on TryHackMe. Insecure file upload vulnerabilities is a quite serious thing so please watch it all and learn how penetration test for Upload Vulnerabilities & Exploit.

Affiliate links:
Get a good deal with NordVPN:

Get a good deal with VidIQ:

Donate:

TryHackMe! Upload Vulnerabilities - File Upload Vulnerabilities & Exploit - Complete walkthrough

Like my videos? Would you consider to donate to me I created a possible way for you to do that.

[invader]

Hey bro just want to say I always go to your page when I get stuck on something for a while, you're helping me out a lot. Thanks man!

[azerty]

Je viens de découvrir votre chaîne. Merci beaucoup pour votre contenu très claire, efficace et concis.

[omn]

Thank you so much for this, not going to lie the last challenge was kinda kickin my ass

[jakeed]

Lost it at your reaction to being rick roll'd. Thanks a lot for this.

[Darth_Maul]

Thank you for all everything that you explained and did in this video. At first (OWASP Juice Shop) and (Upload Vulnerabilities) sites would not work till I re-configured my settings. Thank you again!

[ver]

Im confused on 1:00:50 why did you have to change the filetype of the shell to .jpg if you removed the file-type restrictions? couldnt you just upload the .php shell file directly?

[polycapmuniu]

Yo, just watched your video on File Inclusion vulnerabilities and it's got me hyped for the day ahead! 🙌🔥 Your explanations were on point and made understanding these concepts so much easier. Thanks for breaking it down in such a clear and concise way! Can't wait to dive into more of your content and level up my web hacking skills. Keep dropping those knowledge bombs, fam! 💣💻 #TryHackMe #WebHacking #KnowledgeIsPower

[eyfikzp]

Thank you!
I like the idea of disabling JavaScript on the client side, this way you know for sure if the application completely rely on the front-end to validate file uploads or not.

And for the script.js file at 39:35 it seems that it was obfuscated. There are some good JavaScript deobfuscators online out there if you encounter such files

[Rockadocious]

Thanks so much for this video. This has been helpful. Great job!

[iCyberVenom]

Thank you for all your content! I've watched A LOT of your videos and learned A LOT from you. Friend to friend...you would solve most of these questions/challenges 10x faster if you just slowed down. You're very fast to a fault sometimes. :)

[Fullyraw]

I can't get through forwarding it never goes there when I forward it just stays blank on burp I can't access the assets/js/uploadjs

[zidreel]

One more question. Does a reverse shell automatically execute after successfully uploaded? If yes then why?

[dustinarand]

On Task 9 I did exactly what you did, step by step, but when I clicked Upload, it just says No file selected. What am I missing?

[zidreel]

Haven't watched the video yet but thanks for uploading it! My question is, is there anyway to bypass a system that explicitly converts every uploaded file to a specific format (like JPG). I successfully sent the file to the server. The only problem is that the server converts it to JPG - nullifying the chance of remote execution. I know it's not that easy to bypass. But any tips here will surely help. Thanks

[xCheddarBbx]

I must be having a Monday on Tuesday, over an hour on Task 7, and the submit fails every time.

[rtrdr]

I am stuck in this room maybe tomorrow I'll do it 😃

[EgyptianJoker]

why burp suite does not intercept js file ?

[furkanveliisk]

Hey thanks alot for the videos they are really great. One question I have is I have done and understood everything up till where we execute our file. I used gobuster to enumerate my file, used every 3 worded file results but I keep getting "Module does not exist". Could you help me with this please? And also, another file I uploaded had .js extension (used Burp Suite to intercept and change the MIME type) but all the files I see enumerated have .jpg extension. Thanks a lot again in advance man.